Improper Encryption Handling in Frontend Admin Plugin for WordPress by DynamiApps

CVE-2024-3729

Summary

The Frontend Admin plugin by DynamiApps for WordPress is subject to a vulnerability that arises from improper handling of encryption exceptions in the 'fea_encrypt' function across all versions up to and including 3.19.4. This design flaw allows unauthorized attackers to exploit user-form processing, resulting in the potential for privilege escalation through unauthorized user creation or editing. Additionally, this vulnerability facilitates automatic user logins, creating opportunities for authentication bypass and enabling the injection of arbitrary web scripts into post-processing forms. The exploitation of this vulnerability depends on the 'openssl' PHP extension being omitted from the server configuration.

References